Pindrop survey finds purpose-built deepfake defenses at 10% of US organizations
Pindrop's survey of more than 250 US security leaders found 74% faced or suspected a deepfake attack in the past year. The targets are live channels such as help-desk calls, job interviews and video meetings, and identity controls were not designed to verify who is on them.
The Watch · Security desk
What happened
- Among organizations that experienced or suspected an attack, nearly half put total costs at $500,000 or more and about a quarter at $1 million or more.
- Forty-nine percent of those organizations reported follow-on cyberattacks, ransomware among them, according to Help Net Security's account of the index.
- Three in four respondents said deepfakes will become a board issue only after a leader at their own organization is fooled or impersonated.
- Thirty-seven percent said one deepfake attack could put a company like theirs out of business, and 17% rated that outcome extremely likely or certain.
Why it matters
- Who's exposed exposure At the 90% of surveyed organizations without purpose-built defenses, help-desk agents, recruiters and staff approving requests on video are the only check on whether a live caller is real.
- What doesn't add up contradiction Seventy-four percent expect defenses to improve faster than attacks while 93% call their own organizations unprepared, so the optimism rests on tools most respondents have not bought.
- What it sets up precedent If boards move only after a leader is fooled or impersonated, budget for live-channel defenses will tend to arrive after an organization's first loss.
- Who has to decide decision Responders who close a successful deepfake call as a fraud case risk missing the follow-on intrusion that respondents say often came next.
Next story · Security · 5h ago
Campaigns and PACs spent over $137M promoting AI-made midterm ads, most with no labelConfirmed3 publishers
"Attackers have figured out that one of the easiest ways around sophisticated security controls is to impersonate the human those controls are designed to trust," said Elie Khoury, SVP of research at Pindrop [4]. "Enterprises need to bring the same rigor used to secure systems and devices to the live human interactions where critical decisions are being made," he said [5].
The remote-interview channel already has a known operator. North Korean nation-state hackers have used deepfakes to pose as IT workers applying for jobs at technology and software companies, Infosecurity Magazine reported [16]. The more familiar pattern is an attacker posing as a colleague, a boss or the CEO to get sensitive information or a fraudulent transfer [8]. Neither published account breaks the survey's incidents down by channel. The data counts organizations hit. It does not show whether the help desk, the interview or the meeting was the way in.
The index was published on 28 September and rests on a small pool of self-reported answers [10][2]. Seventy-four percent of just over 250 respondents is about 185 organizations [18]. The quarter of those reporting $1 million or more in costs is roughly 46 organizations [19]. The cost figures also include organizations that only suspected an attack [6].
The two write-ups of the index do not agree on what the money measures. Help Net Security describes the figures as total costs, including direct losses, remediation and staff time [6]. Infosecurity Magazine ties the $1 million tier to "a single incident" and attaches its 49% figure to the $500,000 tier [9]. In Help Net Security's version, 49% is the share of hit organizations reporting follow-on attacks [13].
Infosecurity Magazine's recommended countermeasures are staff training, phishing-resistant controls such as MFA across systems, and watching for suspicious communications and impersonation events [17]. MFA is an identity control. According to the report, identity controls were not designed to determine whether the person speaking or appearing in a live interaction is genuine [11].
What to watch
- A channel-level breakdown from Pindrop showing whether help-desk calls, interviews or video meetings account for most incidents, and how many were confirmed versus suspected.
- Public incident reports that tie a deepfake help-desk call or video meeting to a later ransomware deployment.
- New advisories or indictments on North Korean IT-worker schemes that describe deepfakes used in live job interviews.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption10
- Hype gap+25
- Incentives
- Not scored
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Nearly three-quarters of security leaders have encountered or suspect a deepfake attack in the past year, while just 10% say their organizations have purpose-built defenses, according to Pindrop's 2026 Deepfake Readiness Index.
- [2]
Pindrop surveyed over 250 US security leaders; 74% said they had encountered a suspected deepfake attack in the last 12 months.
- [3]
Phone calls to IT help desks, remote job interviews, and video meetings give attackers opportunities to pose as people an organization trusts; real-time communications have become a target for deepfake and AI impersonation attacks.
- [4]
"Attackers have figured out that one of the easiest ways around sophisticated security controls is to impersonate the human those controls are designed to trust," said Elie Khoury, SVP of Research at Pindrop.
- [5]
"Enterprises need to bring the same rigor used to secure systems and devices to the live human interactions where critical decisions are being made," said Elie Khoury.
- [6]
Of the organizations that experienced or suspected a deepfake attack, nearly half reported total costs of $500,000 or more, including direct losses, remediation, and staff time; about a quarter reported costs of at least $1 million.
- [7]
Three-quarters of respondents said deepfakes would become a boardroom priority only after a leader at their organization was personally fooled or impersonated.
- [8]
Deepfakes are used to pose as someone like a colleague, a boss or a CEO and trick victims into sharing sensitive information or making a fraudulent financial transfer.
- [9]
Infosecurity Magazine reported that one in four of those hit reported losses of over $1m because of a single incident, while nearly half (49%) of those hit reported losses of $500,000.
- [10]
The 2026 Pindrop Deepfake Readiness Index was published on 28 September.
- [11]
Identity controls were not designed to determine whether the person speaking or appearing in a live interaction is genuine.
- [12]
Despite low adoption of purpose-built defenses, 74% of security leaders believe defenses will improve faster than attack quality.
- [13]
Forty-nine percent of organizations that experienced or suspected a deepfake attack reported follow-on cyberattacks, including ransomware.
- [14]
Thirty-seven percent of respondents said the damage from a single deepfake attack could put a company like theirs out of business, including 17% who considered this outcome extremely likely or certain.
- [15]
93% of security leaders expressed concern that their organization is not currently prepared to face the threat posed by deepfake attacks.
- [16]
North Korean nation-state hackers have been known to use deepfakes to pose as fake IT workers looking for jobs to get hired by technology and software companies.
- [17]
Recommended countermeasures: train staff to identify deepfakes, employ phishing-resistant controls such as MFA across systems, and have security teams look out for suspicious communications and impersonation events.
- [18]
About 185 surveyed organizations encountered or suspected a deepfake attack in the past year (a lower bound, since the sample is over 250).
- [19]
Roughly 46 organizations reported deepfake costs of $1 million or more.
- [20]
About 90% of surveyed organizations do not have purpose-built deepfake defenses.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comDeepfakes become a board priority once an executive falls for one
1 article · September 29, 2026
- infosecurity-magazine.comDeepfakes Are Becoming a Costly Reality for Businesses, Report Warns
1 article · September 28, 2026
Topics and entities
Entities
- Pindrop Deepfake Readiness Index